This pack uses lookup files to help drop events, suppress events, and extract fields from surviving events. Using lookup files provides a much cleaner management of potentially hundreds, or thousands, of event types.
For Splunk Delivery: You can either leave (some of) the fields as index time useful for tstats, accelerated data models, etc. Or you you can re-write _raw as a JSON object with the newly extracted fields. Splunk delivery is set-up in prep_for_splunk
, a pipeline chained from the cisco_asa_cleanup
pipeline by default.
For Elastic Delivery: A lookup is used to translate field naming convention from Splunk CIM to Elastic ECS. This lookup is called from the prep_for_ECS
pipeline, which is optionally chained from the cisco_asa_cleanup
pipeline.
For OCSF Delivery: This pack has now partially incorporated support for the OCSF event schema. OCSF is a new common schema which is also a requirement for leveraging AWS Security Lake.
What to expect: Data have mapped across a variety of inputs, in some cases whole data types have been mapped, and in others only certain events. In this pack the following events have been verified to validate against the OCSF 4001 schema:
OCSF functionality is disabled by default. To enable it edit the cisco_asa_cleanup
pipeline and change the active Chained output option to the OCSF option. Only one of the 3 options should be checked!
Before you activate the Pack on live data:
asa_code
,"comment or memo"
asa_code
,"regex_with_named_capture_group(s)"
_no_matches
will be added to each event with a regex defined
true
meaning the regex failed(?<group>foo)|(?<group>bar)
) you'll need to name the second with _ALT. Eg: group_ALT
. This will be undone after extraction automatically.prep_for_ECS
pipeline will create nested objects for names with periods in themYou're encouraged to add to the included CSVs and submit a pull request.
There is a group for handling events that require special attention. These rules fall outside of what can be handled in the parsing CSV lookup file. This is includes some events that require flipping src and dest fields.
Fields extracted are placed at the top level of the event (eg, metadata or index time field). You can choose to:
prep_for_ECS
pipeline to translate them to ECS naming conventions and formatIf you do not require field extractions consider adding the Final Flag to the Eval rule marked as such. You'll get the benefit of volume reduction, and the option to drop unneeded events based on the drops CSV, but you'll save resources of running extractions that go unused.
- Repaired bad regex for 106021, 106022 and 313004
- Added 302020 and 302021 (Thanks @Paul Stout)
- Grouped the dest/src flip together with other Exceptions
- Added exception for 430001-5 events which have variable formatting in "Key: Value" pairs
- Shout out to Slack user @Brenden
- For codes 302013, 302015, 302020, 302021, 602303, 602304, and 702307 we now reverse src and dest fields if the direction is outbound
- See the Flip dest/src fields group
- Shout out to Slack user @Brenden for identifying the mistake
- Fixed 419002: Cisco's docs don't match logs found in the wild, updated regex to work with both
- Added 430002 (thanks @Walter in Cribl Slack!)
- Fixed 106015 to be more permissive of optional interface field
- Fixed 305011 which had bad regex, missing a closing `>`
- host was mistakenly left out of the Splunk delivery pipeline
- Sample filename was wrong
- Added initial/test OCSF support
- Fixed patterns for 313008, 313009, 106023, 305011
- Fixed a typo in the ASA-6-305011 parsing regex
- Added ASA-6-305012 parsing regex
- Added ASA-201009 to parsing file
- Fixed typo is csv lookup file for ASA code 313009 (h/t @olauret)
- Readme file was munged up. No functional changes.
- Fixed bad regex for 106100, 106102 -- missing backslash before right bracket in last group
- The people responsible for the sacking have now been sacked
- Dummy release to fix bad packaging
- Added many codes to parsing lookup from the Elastic ASA package
- Added a pipeline to translate Splunk CIM fields to ECS fields
- Adjusted main pipeline to Chain either the pre_for_splunk or prep_for_ECS pipeline
- Added 199015,199016,199017,199018,313001,313004 to drops
- Added 111007,111008,111010,113005,315011,414003,414004,606001,606002,606003,606004,711004 to parsing
Replaced wonky aggregation function with straight suppression. So much cleaner. Version bumped to 1.0.
fixed bad extract for a few parse lookups
Cleaned up and added some new codes to drop and supress lookups; fixed bad extract for a few parse lookups; added optional aggregation based suppression; updated this doc
Fixed bad asa_code extract; added option to keep _raw as is; cleaned up docs
Serialize option added, suppression added with one sample code
Added readme, and image
1st release
To contribute to the Pack, contact Jon Rust jrust@cribl.io
To contact us please email jrust@cribl.io.
This Pack uses the following license: Apache 2.0
.